Artificial intelligence is transforming the way we live, work, and interact, often faster than governments or citizens can keep up. For years, this powerful technology developed in a near-legal vacuum, raising hopes of innovation but also fears of abuse. That changed when the European Union introduced the AI Act, the world’s first comprehensive law governing the use of artificial intelligence. More than a legal milestone, the Act is Europe’s declaration that technology must serve society, not the other way around. Just as the EU’s landmark data protection rules reshaped global privacy standards, this bold new framework is set to influence how AI is built and deployed far beyond Europe’s borders.
A law years in the making
Brussels has spent years wrestling with a simple but urgent question: how do you regulate a technology that changes faster than politics? The European Commission launched its proposal in 2021, setting off a long process of debate and negotiation. After intense lobbying and compromise, the European Parliament approved the final text in March 2024, and EU governments in the Council gave their backing two months later. On August 1, the AI Act officially entered into force, marking a global first.1
However, the AI Act is not being implemented all at once. Some provisions, such as bans on the most dangerous AI systems, took effect within six months. Others will be phased in over the next three years, giving companies space to adapt.2 This slow rollout reflects both the ambition of the legislation and the difficulty of writing rules for a technology that refuses to stand still.
A risk-based outlook
The core of the AI Act is its risk-based approach. Instead of treating all algorithms the same, the EU categorized AI systems. “Unacceptable risk” systems are banned completely. This includes social scoring, where people are judged by automated systems, and unauthorized real-time biometric surveillance. “High-risk” systems, such as AI used in healthcare, policing, or hiring, are allowed only under strict conditions. They must meet standards for transparency, oversight, and safety testing. “Limited risk” systems, like deepfakes, must inform users that they are interacting with AI. “Minimal risk” tools, such as spam filters, face little regulation.3
The rise of foundation models
A recent addition to the AI Act is its emphasis on general-purpose AI (GPAI). These are large, adaptable systems like ChatGPT that can write text, answer questions, or generate code. Unlike AI designed for a single task, foundation models can be built into many different products and services, from chatbots to medical tools. That versatility makes them powerful but also unpredictable, which is why the EU decided they deserve their own set of rules.
From August 2025, GPAI providers will face strict transparency obligations. They must share technical documentation with regulators and with companies that rely on their models, publish a summary of the data used for training, and adopt policies to respect copyright law. These measures are meant to lift the lid on systems that are often treated as “black boxes,” giving both officials and the public a clearer picture of how they work and what fuels them.4
For models considered a systemic risk, meaning they are so large or widely used that failures could have serious consequences, the rules go further. Developers must run safety tests, report serious incidents, and put strong cybersecurity protections in place.5 By carving out these additional safeguards, the EU is signalling that foundation models are not just another type of AI but the engines of the digital future. The aim is to make them accountable without cutting off the innovation they promise.
Who falls under the law?
The scope of the AI Act is intentionally broad. It does not just cover European tech companies but also any foreign business whose AI systems are used inside the EU. A U.S. startup offering AI-driven hiring software in Berlin, or a Chinese company selling facial-recognition tools in Paris, would both have to play by Europe’s rules. Just as the EU’s data protection law (GDPR) set the global benchmark for privacy, the AI Act is expected to export European standards around the world.6
There are, however, a few exceptions. According to Recital 24 of the AI Act, AI built for military or national security purposes is excluded, as is research still in the lab. But once an AI system makes the leap from experimentation to the marketplace, the law applies. The idea is simple: innovation should thrive in early stages, but once AI enters people’s daily lives, it must be subject to safeguards that protect society.
The watchdogs of AI
Regulating artificial intelligence is no small task, so the EU has set up new institutions to keep watch. At the centre is the European AI Office, a body within the European Commission that will monitor compliance and step in when powerful general-purpose models step out of line. National authorities in each member state will also play a role, coordinated to make sure the rules are applied consistently across the Union.
To avoid leaving these decisions to politicians and lawyers alone, the framework also brings in outside voices. An independent panel of scientists will provide technical expertise, while an advisory forum will give civil society groups and industry representatives a seat at the table. The aim is to strike a balance: rules that are rigorous enough to keep people safe, but also legitimate and inclusive enough to earn public trust.7
Power, penalties, and the politics of innovation
The AI Act comes with teeth. Companies caught using banned systems can be fined up to €35 million or seven percent of their global revenue. Even lesser violations carry fines of up to €15 million or three percent of revenue, as stipulated in Article 99 of the AI Act. These numbers are not symbolic. They echo the strict enforcement of the EU’s data protection law, GDPR, where regulators showed they were willing to take on some of the world’s biggest companies. Few expect the AI Act to be any different.
But big penalties are only part of the story. The law has also sparked debate about whether strict regulation will stifle innovation. Critics warn that compliance costs could hit startups hardest, leaving them unable to compete with large tech firms that have the resources to cope. Even some European leaders share these concerns.8 Sweden’s Prime Minister Ulf Kristersson has called parts of the law confusing and burdensome, suggesting that the EU may be undermining its own competitiveness.9
Supporters counter that clear rules are the key to building public trust. If citizens feel protected, they argue, they will be more willing to accept AI in sensitive areas like healthcare or finance. For them, the AI Act is not an obstacle to innovation but the foundation of an ethical and sustainable digital economy.10 The clash of views reveals a familiar European challenge: how to regulate boldly without slowing growth in a global race.
From daily life to global influence
While the political debate continues, industries are already adjusting. In fashion, AI tools that recommend outfits or run virtual fitting rooms now need human oversight and transparency. In media, generative systems must be labeled or watermarked, reshaping how audiences consume images and video. Even American companies are rethinking their practices, updating documentation and audit processes to avoid trouble with European regulators. Just as GDPR became the world’s privacy benchmark, the AI Act is already pushing firms worldwide to design safer, more transparent AI.
The stakes extend far beyond Europe. In the United States, the government has issued executive orders and voluntary guidelines, but no binding law. China has drawn up its own rules, shaped by its political priorities. This patchwork approach has left the global AI landscape divided. Against this backdrop, Europe is positioning itself as the champion of trustworthy AI. Whether other powers will follow its lead remains uncertain, but the EU has already made one point clear: artificial intelligence will not remain a lawless frontier.
Conclusion: a bold experiment
The AI Act is both pioneering and imperfect. It is pioneering because Europe has chosen to write rules for artificial intelligence before the technology has fully matured. It is imperfect because no law can anticipate every risk, every breakthrough, or every misuse that may still emerge.
What matters is that Europe has acted. By putting forward the world’s first comprehensive framework, the EU hopes to protect its citizens while shaping the terms of the global debate. The gamble is clear: that democratic societies can harness technological power without sacrificing rights or trust. Whether other nations follow Europe’s lead or strike out on their own path, one thing is certain. Artificial intelligence will no longer develop in a vacuum, and the rules written in Brussels will be impossible to ignore.
References
1 European Commission, “AI Act Enters into Force,” European Commission, August 1, 2024.
2 EU Artificial Intelligence Act, “Implementation Timeline,” EU Artificial Intelligence Act, last updated 1 August 2024.
3 European Commission, “AI Act Enters into Force,” European Commission, August 1, 2024.
4 Ibid.
5 European Commission, “The General-Purpose AI Code of Practice,” European Commission, 10 July 2025.
6 European Commission, “AI Act,” European Commission, 25 July 2025.
7 Ibid.
8 Public Cloud Group, “Between Innovation and Regulation: The EU AI Act,” PCG, 28 March 2024.
9 Pieter Haeck, “Swedish PM Calls for a Pause of the EU’s AI Rules,” Politico, 23 June 2025.
10 Raluca Csernatoni, “The EU’s AI Power Play: Between Deregulation and Innovation,” Carnegie Endowment for International Peace, May 20, 2025.